# Security reports

DefenceLevel

If you find a vulnerability in DefenceLevel's systems, we want to know. This page explains how to report it, what we ask of you and what we commit to doing.

Last updated: 2 October 2026 · Also available in standard format: `/.well-known/security.txt`

## How to report

Write to **security@defencelevel.com** stating:

- the affected system or address;
- a description of the problem and its possible impact;
- the steps to reproduce it (requests, parameters, screenshots);
- how you prefer to be contacted and, if you wish, the name under which you would like to be thanked.

You can write to us in English or Italian.

## Scope

In scope: the **defencelevel.com** website and its subdomains, the defencelevel.eu and defencelevel.it domains, the subscriber dashboard, the service functions and the emails we send.

Out of scope: the services of our providers (Vercel, Supabase, Resend, Stripe, OVHcloud), which should be reported directly to them; third-party vulnerabilities that we describe in the briefing, which should be reported to the respective vendors.

## What we ask of you

- Do not access, modify or delete other users' data: if you happen to see any, stop and let us know.
- Do not degrade the service: no denial-of-service attacks, load tests or mass sending of requests or emails.
- No social engineering against us or our users, no physical attacks, no use of other people's accounts.
- Give us reasonable time to fix the problem before making it public.

## What we commit to doing

- Acknowledge receipt of the report within **5 working days**.
- Keep you informed about the assessment and the fix.
- Thank you publicly, if you wish, once the problem is resolved.
- Not take legal action against anyone who reports in good faith and in accordance with the rules on this page.

We do not currently offer financial rewards for reports.

---

Web page: https://defencelevel.com/security